PT-2023-29493 · Unknown · Mtproto Proxy

Published 2023-10-10 · Updated 2024-09-18 · CVE-2023-45312

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions mtproto proxy versions through 0.7.2

Description A low-privileged remote attacker can access an improperly secured default installation without authenticating and achieve remote command execution ability.

Recommendations For versions through 0.7.2, update to a version that secures the default installation and requires proper authentication to prevent remote command execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Weakness Enumeration

CWE-1188

CWE-94

Related Identifiers

CVE-2023-45312

GHSA-738Q-MC72-2Q22

Affected Products

Mtproto Proxy

References · 7

• 🔥 https://medium.com/@_sadshade/almost-2000-telegram-proxy-servers-are-potentially-vulnerable-to-rce-since-2018-742a455be16b · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-45312 · Security Note
• https://osv.dev/vulnerability/CVE-2023-45312 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-738q-mc72-2q22 · Vendor Advisory
• https://github.com/seriyps/mtproto_proxy · Note
• https://t.me/cvenotify/95154 · Telegram Post
• https://medium.com/%40_sadshade/almost-2000-telegram-proxy-servers-are-potentially-vulnerable-to-rce-since-2018-742a455be16b · Note